Fix broken tests

Emyrk · Emyrk · commit 945e9fab304a · 2022-05-12T09:49:29.000-05:00
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -135,8 +135,8 @@ func New(options *Options) (http.Handler, func()) {
 				//	Should files be org scoped? User scoped?
 				httpmw.WithRBACObject(rbac.ResourceFile),
 			)
-			r.Get("/{hash}", authorize(api.fileByHash, rbac.ActionRead))
-			r.Post("/", authorize(api.postFile, rbac.ActionCreate, rbac.ActionUpdate))
+			r.Get("/{hash}", api.fileByHash)
+			r.Post("/", api.postFile)
 		})
 		r.Route("/organizations/{organization}", func(r chi.Router) {
 			r.Use(
diff --git a/coderd/coderd_test.go b/coderd/coderd_test.go
@@ -2,11 +2,12 @@ package coderd_test
 
 import (
 	"context"
-	"fmt"
 	"net/http"
 	"strings"
 	"testing"
 
+	"golang.org/x/xerrors"
+
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -43,7 +44,7 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
 	require.NoError(t, err, "fetch org")
 
 	// Always fail auth from this point forward
-	authorizer.AlwaysReturn = rbac.ForbiddenWithInternal(fmt.Errorf("fake implementation"), nil, nil)
+	authorizer.AlwaysReturn = rbac.ForbiddenWithInternal(xerrors.New("fake implementation"), nil, nil)
 
 	// skipRoutes allows skipping routes from being checked.
 	type routeCheck struct {
@@ -123,13 +124,16 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
 		"GET:/api/v2/workspaces/{workspace}/builds":    {NoAuthorize: true},
 		"POST:/api/v2/workspaces/{workspace}/builds":   {NoAuthorize: true},
 
+		"POST:/api/v2/files":       {NoAuthorize: true},
+		"GET:/api/v2/files/{hash}": {NoAuthorize: true},
+
 		// These endpoints have more assertions. This is good, add more endpoints to assert if you can!
 		"GET:/api/v2/organizations/{organization}": {AssertObject: rbac.ResourceOrganization.InOrg(admin.OrganizationID)},
 		"GET:/api/v2/users/{user}/organizations":   {StatusCode: http.StatusOK, AssertObject: rbac.ResourceOrganization},
 		"GET:/api/v2/users/{user}/workspaces":      {StatusCode: http.StatusOK, AssertObject: rbac.ResourceWorkspace},
 	}
 
-	c := srv.Config.Handler.(*chi.Mux)
+	c, _ := srv.Config.Handler.(*chi.Mux)
 	err = chi.Walk(c, func(method string, route string, handler http.Handler, middlewares ...func(http.Handler) http.Handler) error {
 		name := method + ":" + route
 		t.Run(name, func(t *testing.T) {
@@ -188,7 +192,7 @@ type fakeAuthorizer struct {
 	AlwaysReturn error
 }
 
-func (f *fakeAuthorizer) AuthorizeByRoleName(ctx context.Context, subjectID string, roleNames []string, action rbac.Action, object rbac.Object) error {
+func (f *fakeAuthorizer) AuthorizeByRoleName(_ context.Context, subjectID string, roleNames []string, action rbac.Action, object rbac.Object) error {
 	f.Called = &authCall{
 		SubjectID: subjectID,
 		Roles:     roleNames,
diff --git a/coderd/rbac/builtin.go b/coderd/rbac/builtin.go
@@ -64,11 +64,7 @@ var (
 			return Role{
 				Name:        member,
 				DisplayName: "Member",
-				Site: permissions(map[Object][]Action{
-					// All users can read all organizations.
-					// TODO: @emyrk is this ok?
-					ResourceOrganization: {ActionRead},
-				}),
+				Site:        permissions(map[Object][]Action{}),
 				User: permissions(map[Object][]Action{
 					ResourceWildcard: {WildcardSymbol},
 				}),
diff --git a/coderd/users_test.go b/coderd/users_test.go
@@ -401,10 +401,11 @@ func TestGrantRoles(t *testing.T) {
 			[]string{rbac.RoleOrgMember(first.OrganizationID)},
 		)
 
+		memberUser, err := member.User(ctx, codersdk.Me)
+		require.NoError(t, err, "fetch member")
+
 		// Grant
-		// TODO: @emyrk this should be 'admin.UpdateUserRoles' once proper authz
-		//		is enforced.
-		_, err = member.UpdateUserRoles(ctx, codersdk.Me, codersdk.UpdateRoles{
+		_, err = admin.UpdateUserRoles(ctx, memberUser.ID, codersdk.UpdateRoles{
 			Roles: []string{
 				// Promote to site admin
 				rbac.RoleMember(),
@@ -588,12 +589,13 @@ func TestOrganizationByUserAndName(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
 		first := coderdtest.CreateFirstUser(t, client)
+		notMember := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
 		other := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
 		org, err := other.CreateOrganization(context.Background(), codersdk.Me, codersdk.CreateOrganizationRequest{
 			Name: "another",
 		})
 		require.NoError(t, err)
-		_, err = client.OrganizationByName(context.Background(), codersdk.Me, org.Name)
+		_, err = notMember.OrganizationByName(context.Background(), codersdk.Me, org.Name)
 		var apiErr *codersdk.Error
 		require.ErrorAs(t, err, &apiErr)
 		require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())
